NVD

Id
25556  
Name
CVE-2015-3986  
Description
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-05-14  
Modified Date
2016-11-28  
Seq
2015-3986  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
134989 25556 CVE-2015-3986 http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html  View
134990 25556 CVE-2015-3986 20150429 Multiple Vulnerabilities in TheCartPress WordPress plugin  View
134991 25556 CVE-2015-3986 74395  View
134992 25556 CVE-2015-3986 https://wordpress.org/plugins/thecartpress/changelog/  View
134993 25556 CVE-2015-3986 36860  View
134994 25556 CVE-2015-3986 https://www.htbridge.com/advisory/HTB23254  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7373 JVNDB-2015-002693 WordPress 用 TheCartPress eCommerce Shopping Cart プラグインにおけるクロスサイトリクエストフォージェリの脆弱性 WordPress 用 TheCartPress eCommerce Shopping Cart (別名 The Professional WordPress eCommerce Plugin) プラグインには、クロスサイトリクエストフォージェリの脆弱性が存在します。 CVE-2015-3986 81211 CVE-2015-3986 25556 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002693.html 2015-05-03 2015-05-19 View